Over 1,300 Microsoft SharePoint servers exposed online remain unpatched against CVE-2026-32201, a spoofing vulnerability that Microsoft says was exploited as a zero-day and that attackers continue to abuse in ongoing campaigns.
Scope of the exposure: more than 1,300 public servers still vulnerable
Internet security watchdog Shadowserver warned this week that more than 1,300 Microsoft SharePoint servers reachable from the public Internet have not received the April 2026 security update that addresses CVE-2026-32201. Shadowserver said fewer than 200 systems have been patched since Microsoft released the fixes last week, leaving a large population of servers exposed.
What the vulnerability is and which SharePoint editions are affected
Microsoft described CVE-2026-32201 as an improper input validation weakness that enables network spoofing. The flaw affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition — the on-premises edition that uses a "continuous update" model. Microsoft said the vulnerability was flagged as a zero-day and that successful exploitation enables an attacker without privileges to perform low-complexity attacks that do not require user interaction.
Microsoft summarized the potential impact in technical terms: "An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality), make changes to disclosed information (Integrity), but cannot limit access to the resource (Availability)." The company has not disclosed how the zero-day was used in the wild or linked the activity to any named threat actor.
CISA, Microsoft, and the federal directive: an accelerated deadline
Microsoft shipped security updates for CVE-2026-32201 as part of its April 2026 Patch Tuesday on April 14, the same day the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. CISA used its authority under Binding Operational Directive (BOD) 22-01 to order Federal Civilian Executive Branch (FCEB) agencies to remediate affected SharePoint servers within two weeks — setting an April 28 deadline.
In its advisory, CISA warned: "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," and instructed agencies to "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
Shadowserver's tally and the operational reality for administrators
Shadowserver's scan-based estimate — over 1,300 publicly reachable SharePoint instances remaining unpatched — underscores a gap between patch availability and deployment. Microsoft addressed 167 vulnerabilities in the April 14 update, including two zero-days; nevertheless, the watchdog group found that the bulk of exposed SharePoint servers have not yet received or applied the fix for CVE-2026-32201.
The persistence of unpatched, Internet-facing SharePoint instances raises the chance that attackers can discover and exploit vulnerable targets without needing to chain multiple faults or to trick end users into interaction.
How FCEB agencies, enterprises, and security teams should be thinking about the incident
- Federal Civilian Executive Branch agencies: The CISA Binding Operational Directive gives a concrete two-week remediation clock that federal agencies must meet. Agencies will need to either apply the vendor-supplied mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use of affected products if mitigations are not available.
- Enterprises running on-premises SharePoint Server: Organizations operating SharePoint Server 2016, 2019, or Subscription Edition that expose instances to the Internet should prioritize applying the April 14 updates for CVE-2026-32201 and verify that external-facing services are not left in an unpatched state.
- Security operations and incident response teams: With the vulnerability characterized as a zero-day that was exploited in live attacks and added to CISA's KEV Catalog, teams should prioritize discovery of public SharePoint endpoints, confirm patch status, and monitor for indicators of compromise tied to spoofing or unauthorized data access attempts.
Microsoft's disclosure that it has not yet tied the zero-day use to a specific threat actor leaves defenders to act on the vulnerability's technical profile and the observable exposure of servers. The concurrence of a public patch release, a CISA KEV listing with a mandatory federal remediation timeline, and Shadowserver's tally of more than 1,300 unpatched, Internet-facing SharePoint servers creates a sharply defined operational problem: the fixes exist, but a meaningful fraction of exposed systems remain awaiting them.
Source: BleepingComputer — Over 1,300 Microsoft SharePoint servers vulnerable to ongoing attacks
